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Summary 


Section 48 of the Freedom of Information Act (FOIA) empowers the information Commissioner (the Commissioner) to issue a 
practice recommendation where it appears to him that a public authority has failed to conform, specifically, to the FOIA 
Codes of Practice. These failures are addressed in the recommendations section below. 


NHS England has a poor level of performance in terms of the time limit for complying with information requests. Recent 
figures showing that NHS England has only been able to meet the statutory timeframe for responding to requests in 
2022/2023 in 81% of cases. The Commissioner is also aware of issues with late internal review responses, with 200 overdue 
at the end of 2022/2023 and NHS England has a backlog of older requests dating back to 2019 which remain unanswered. 


Following engagement by the Commissioner's staff with NHS England about the underlying reasons for these failings, the 
Commissioner has reached the view that NHS England’s request handling practices do not conform to Part 4 of the section 45 
Freedom of Information Code of Practice, issued by the Cabinet Office in July 2018. Whilst the Commissioner has decided to 
make this practice recommendation, he wants to acknowledge the constraints that NHS England has been operating under. 
Since the Covid-19 pandemic NHS England has received increased numbers of requests each year. This upward trend has 
continued with NHS England receiving 30% more requests to date in 2023 than in the same period in 2022. NHS England 
merged with Health Education England in April 2023 and NHS Digital in February 2023, this followed on from a merger with 
NHS Improvement in July 2022. It is therefore undergoing a significant change programme to create the new NHS England. 
This also requires the new combined organisation to be 30-40% smaller. 


NHS England had anticipated the mergers would impact on the number of requests received but demand has so far 
outstripped expectation. Whilst the Commissioner is aware that these mergers will have had an impact on NHS England’s 
ability to meets its statutory obligations, and he has taken this into account as part of his considerations, he cannot overlook 
the backlog of unanswered requests and his concerns over its ability going forward to comply with the statutory timeframe if 
the volume of incoming requests continues at the same level. 


The Commissioner has had regular engagement with NHS England since 2018 so has had an overarching view of NHS 
England’s FOI compliance over a period pre-dating the pandemic. In September 2022 NHS England put in place an action 
plan to tackle the backlog of requests that had built up during the pandemic. The action plan indicated NHS England’s 
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intention was to clear this backlog of requests by the end of March 2023 with NHS England focusing its resources on 
responding to incoming new requests within statutory timeframes and tackling its oldest requests with any remaining 
resources. The Commissioner noted an increased number of complaints to his office being received about the timeliness of 
NHS England’s responses. Figures showed that in 2023 to date 18 decision notices had been issued where the sole issue was 
about late or non-responses to information requests and required NHS England to respond. In comparison, the Commissioner 
issued eight decision notices in the whole of 2022 on the same issue. This prompted the Commissioner to engage again with 
NHS England and ask for up to date figures on its current requests and backlog. The figures provided as of May 2023 showed 
470 overdue requests, of which 193 date from before September 2021. 


Recommendations 


The Commissioner had discussions with NHS England concerning the issues set out above and is aware that NHS England 
has a plan in place to implement a number of improvements to its request handling processes. NHS England has drawn up 
an action plan designed to remedy the current position and bring its request handling back to acceptable levels of 
compliance. The Commissioner has therefore designed the following recommendations to support and enhance NHS 
England’s plans to improve its information rights practices. 


In considering these recommendations, we expect NHS England to ensure that it meets the requirements of all information 
rights legislation to which it is subject. 
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Area of Code 


Part 4 — time limits for 
responding to requests 


Section 4.1 of the Code 
highlights the “clear” 
requirement that public 
authorities respond to 
requests for information 
promptly, and within 20 
working days of receipt in 
accordance with section 10(1) 
of FOIA. 


Section 4.4 of the Code states 
that public authorities may 
exceed the 20 working day 
deadline if additional time is 


required to consider the public 


interest. 


Section 4.6 of the Code 
advises that it is best practice 
for an extension to be no 
more than a further 20 
working days although a 
longer extension may be 
appropriate depending on the 
circumstances of the case, 
including the complexity and 
volume of the material. 


Non-conformity 


In 2023, the Commissioner 
has received 79 complaints 
about NHS England. 66 of 
these were solely about 
timeliness of responses. 18 
of the cases resulted in a 
section 10 decision notice 
either requiring NHS England 
to respond to the request or 
recording that the response 
or information was provided 
late. 


For the year 2022/2023 NHS 
England responded to 81% 
of FOIA requests within the 
statutory time limits. 


Recommendation of steps to be taken 


NHS England should ensure that requests for 
information are responded to in a timely manner. 
When chased to issue responses by the 
Commissioner’s Case Officers, NHS England should 
respond in a timely and appropriate manner. This 
will avoid unnecessary decision notices and the 
subsequent further delays for the requesters. 


NHS England should use the Commissioner's FOI 
self-assessment toolkit to improve its timeliness 
compliance. 


In accordance with part 8.5 of the Code, NHS 
England should publish its information access 
request statistics and make these easily accessible 
on its website. The statistics should include the 
number of information access requests that have not 
been processed and the number of completed 
requests where the processing took longer than 20 
working days. 


NHS England’s request handling procedures should 
include provision for when a response is late, or is 
likely to be late at any stage of the internal 
processes, it is clear when and to who to escalate, 
who is responsible for taking action, the action they 
will need to take, and by when. 


NHS England must ensure that its information rights 
training is sufficient to ensure that it has adequate 
coverage in place in order that request handling 
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Section 4.7 of the Code 
makes clear that when a 
public interest test extension 
is required, the public 
authority must inform 
requestors which exemption 


or exemptions it is relying on. 


Part 5 - Internal reviews 


Sections 5.4 and 5.5 of the 
Code set out that a 
reasonable time for the 
completion of an internal 
review is 20 working days 
following the receipt of the 
request for review, and that, 
usually, no more than 40 


working days will be required. 


At the end of 2022/2023 
NHS England had 211 
outstanding internal reviews. 
Of these 200 were overdue. 
During this period NHS 
England completed 62 
internal reviews within 40 
working days, 22 of these 
within 20 working days. 


times do not fall below a compliant level in the event 
of the departure of key staff members. 


NHS England should publish on its website the action 
plan that it is implementing to address the issues 
outlined in this practice recommendation so that 
there is full transparency about the improvements it 
is making. Any subsequent updates or changes to 
that plan should also be published, with progress 
reported on a quarterly basis and an update also 
provided to the Commissioner in advance of the 
publication of each update. 


NHS England should assess over the next 6 months 
whether the measures it is implementing are having 
the effect it anticipates to bring its performance back 
into line with its statutory obligations. Improvement 
should be seen in not only responding to new 
request in line with statutory timeframes but also in 
reducing the backlog of outstanding requests dating 
back to 2019. 


NHS England should ensure that requests for internal 
reviews are completed within the reasonable times 
specified in section 5.4 and 5.5 of the Code are 
responded to in a timely manner. When chased to 
issue internal review responses by the 
Commissioner’s Case Officers, NHS England should 
respond in a timely and appropriate manner. This 
will avoid unnecessary subsequent further delays for 
the requesters. 
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Section 5.8 of the Code sets 
out that internal reviews 
should provide “a fair and 
thorough review” of relevant 
matters. 


Reasons for issuing this Practice Recommendation 


The Commissioner is issuing a Practice Recommendation at this time rather than an Enforcement Notice because, despite the 
significance of the issues currently affecting requesters, NHS England has engaged openly with his Office about the problems 
it has faced and continues to face, including the impact of the mergers it has and is going through. The Commissioner also 
recognises that NHSE requires time to work through the design of a new permanent FOI team which reflects the broader FOI 
remit and caseload of the new organization. 


This practice recommendation formalises the Commissioner’s concerns and holds NHS England accountable for improving its 
freedom of information request handling practices and, in turn, increase public confidence and trust in its information rights 
practices. 


Failure to comply 


A practice recommendation cannot be directly enforced by the Commissioner. However, failure to comply with a practice 
recommendation may lead to a failure to comply with FOIA, which in turn may result in the issuing of an enforcement notice. 
Further, a failure to take account of a practice recommendation may lead in some circumstances to an adverse comment in a 
report to Parliament by the Commissioner. 
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NHS England should write to the Commissioner by 31 December 2023 to confirm that it has complied with its 
recommendations and how it has achieved this. It should also provide a quarterly update by 29 September 20230n its 
progress. 


The Commissioner will have regard to this practice recommendation in his handling of subsequent cases involving NHS 
England. 


